Skills when-orchestrating-swarm-use-swarm-orchestration
📦
when-orchestrating-swarm-use-swarm-orchestration
v1.0.0 Content revision r1 High Risk ⚙️ External commands
Orchestrate Multi-Agent Claude Flow Swarms
Large development tasks are hard to split, assign, and monitor across agents. This skill provides a phased Claude Flow process for planning, execution, monitoring, and synthesis.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "when-orchestrating-swarm-use-swarm-orchestration" from https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "when-orchestrating-swarm-use-swarm-orchestration". Plan a full-stack application build with multiple agent roles.
Expected outcome:
- A phased task tree covering architecture, backend, frontend, infrastructure, and testing.
- Agent assignments for coordinators, researchers, coders, reviewers, and testers.
- Validation checkpoints for dependencies, progress, and final synthesis.
Using "when-orchestrating-swarm-use-swarm-orchestration". Monitor a swarm that may have blocked work.
Expected outcome:
- A progress summary with completed, active, pending, blocked, and failed task counts.
- A blocker review focused on stale tasks, dependency failures, and unresponsive agents.
- Recommended follow-up actions for reassignment, retry, or escalation.
Using "when-orchestrating-swarm-use-swarm-orchestration". Synthesize results after a multi-agent run.
Expected outcome:
- Grouped results by architecture, implementation, and testing phases.
- A final validation checklist for completeness and data loss risks.
- A report outline with metrics, timeline, outputs, and unresolved issues.
Security Audit
High Riskv8 • 7/5/2026 Open versioned report
The skill is not malicious, and no prompt injection text was found. It does contain real external command risk because many examples run npx claude-flow@alpha, spawn agents, monitor tasks, and write artifacts. Several static hits were markdown, JSON, JavaScript, shebang, jq, date, or workflow-status false positives.
4
Files scanned
928
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unpinned Alpha Package Execution
The skill repeatedly instructs users to run npx claude-flow@alpha. npx can fetch and execute package code, and the alpha tag is mutable.
The commands are direct npx invocations using the mutable @alpha tag. This is a clear supply-chain and remote code execution risk if run without approval.
Medium
Unbounded Swarm Resource Usage
The workflow spawns many agents and starts long-running monitors. Without explicit user limits, this can consume compute, tokens, and project resources unexpectedly.
The cited lines spawn multiple agent types and run background monitoring loops. The behavior is documented, but resource limits and consent checks are not specified.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Shell command substitution
COMPLETED=$(npx claude-flow@alpha task list --filter "completed" | wc -l)
The substitution runs npx claude-flow@alpha inside monitoring or counting logic. It is intended orchestration behavior, but it executes an external command in the local environment.
Medium
Shell command substitution
TOTAL=$(npx claude-flow@alpha task list | wc -l)
The substitution runs npx claude-flow@alpha inside monitoring or counting logic. It is intended orchestration behavior, but it executes an external command in the local environment.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Ruby/shell backtick execution
```bash
The referenced bash block instructs users or agents to run npx claude-flow@alpha and write workflow artifacts. This is intended behavior, but it executes an external npm package and can alter local state.
Medium
Shell command substitution
DEP_STATUS=$(npx claude-flow@alpha task status --task-id $DEP --format json | jq -r '.status')
The command passes values derived from decomposition.json into npx claude-flow arguments. An untrusted or malformed plan file could cause unintended task or agent operations.
Medium
Shell command substitution
AGENT_ID=$(npx claude-flow@alpha agent list \
The command passes values derived from decomposition.json into npx claude-flow arguments. An untrusted or malformed plan file could cause unintended task or agent operations.
Medium
Shell command substitution
COMPLETED=$(npx claude-flow@alpha task list --filter "completed" | wc -l)
The substitution runs npx claude-flow@alpha inside monitoring or counting logic. It is intended orchestration behavior, but it executes an external command in the local environment.
Medium
Shell command substitution
TOTAL=$(npx claude-flow@alpha task list | wc -l)
The substitution runs npx claude-flow@alpha inside monitoring or counting logic. It is intended orchestration behavior, but it executes an external command in the local environment.
Medium
Shell command substitution
RESEARCHER_RESULTS=$(npx claude-flow@alpha task results --agent-type researcher --format json)
The command collects task results through npx claude-flow into shell variables. Those results may contain project data, so this external command use needs consent and scope control.
Medium
Shell command substitution
CODER_RESULTS=$(npx claude-flow@alpha task results --agent-type coder --format json)
The command collects task results through npx claude-flow into shell variables. Those results may contain project data, so this external command use needs consent and scope control.
Medium
Shell command substitution
REVIEWER_RESULTS=$(npx claude-flow@alpha task results --agent-type reviewer --format json)
The command collects task results through npx claude-flow into shell variables. Those results may contain project data, so this external command use needs consent and scope control.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Medium
Template literal with command substitution
```bash
The bash block combines shell expansion with npx claude-flow orchestration actions. The pattern is legitimate for this workflow, but it remains real external command execution.
Risk Factors
⚙️ External commands (71)
PROCESS.md:53 PROCESS.md:54 PROCESS.md:6 SKILL.md:74-102 SKILL.md:102-107 SKILL.md:107-118 SKILL.md:118-121 SKILL.md:121-132 SKILL.md:132-135 SKILL.md:135-147 SKILL.md:147-151 SKILL.md:151-170 SKILL.md:170-192 SKILL.md:192-230 SKILL.md:230-234 SKILL.md:234-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-296 SKILL.md:296-326 SKILL.md:326-330 SKILL.md:330-368 SKILL.md:368-372 SKILL.md:372-390 SKILL.md:390-412 SKILL.md:412-447 SKILL.md:447-451 SKILL.md:451-462 SKILL.md:462-466 SKILL.md:466-486 SKILL.md:486-508 SKILL.md:508-539 SKILL.md:539-543 SKILL.md:543-554 SKILL.md:554-559 SKILL.md:559-564 SKILL.md:564-567 SKILL.md:567-576 SKILL.md:576-579 SKILL.md:579-595 SKILL.md:595-599 SKILL.md:599-616 SKILL.md:194 SKILL.md:335 SKILL.md:338 SKILL.md:339 SKILL.md:340 SKILL.md:345 SKILL.md:355-358 SKILL.md:421 SKILL.md:422 SKILL.md:423 SKILL.md:469 SKILL.md:471 SKILL.md:538 SKILL.md:561 SKILL.md:562 SKILL.md:563 SKILL.md:569 SKILL.md:572 SKILL.md:575 SKILL.md:587 SKILL.md:192-230 SKILL.md:330-368 SKILL.md:412-447 SKILL.md:466-486 SKILL.md:508-539 SKILL.md:559-564 SKILL.md:567-576 SKILL.md:579-595 SKILL.md:331
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
DNYoussef. (2026). when-orchestrating-swarm-use-swarm-orchestration security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/audits/8BibTeX citation
@techreport{dnyoussef-dnyoussef-when-orchestrating-swarm-use-swarm-orchestration-2026,
author = {DNYoussef},
title = {when-orchestrating-swarm-use-swarm-orchestration security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/audits/8},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-orchestrating-swarm-use-swarm-orchestration security audit report (audit version 8)"
version: "1.0.0"
type: report
authors:
- name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-orchestrating-swarm-use-swarm-orchestration/audits/8"
identifiers:
- type: other
value: "skillstore:dnyoussef-when-orchestrating-swarm-use-swarm-orchestration:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
71
Community
78
Spec Compliance
What You Can Build
Coordinate a large application build
Plan architecture, backend, frontend, infrastructure, testing, and review work across specialized agents.
Standardize agent workflow execution
Use the phase checklist to keep decomposition, assignment, monitoring, and synthesis consistent across projects.
Review swarm execution quality
Collect progress metrics, blocked tasks, final outputs, and performance targets after a multi-agent run.
Try These Prompts
Decompose a Task
Use this skill to decompose this task into phases, dependencies, and suggested agent roles: [task].
Prepare a Swarm Plan
Create a Claude Flow swarm plan for [project]. Include topology, coordinators, specialist agents, dependencies, and validation checks.
Monitor Active Execution
Use this skill to define monitoring steps for the active swarm. Focus on completion rate, blocked tasks, agent health, and progress reporting.
Recover and Synthesize Results
Analyze this swarm state: [status]. Recommend recovery actions, final result collection, synthesis groups, validation checks, and report contents.
Best Practices
- Review every shell command before running it in a project workspace.
- Set explicit agent, duration, and output limits before orchestration starts.
- Validate dependencies and final outputs before accepting synthesized results.
Avoid
- Do not run unpinned package commands in sensitive repositories without approval.
- Do not spawn large swarms before defining task scope and success criteria.
- Do not treat synthesized output as correct without human review.
Frequently Asked Questions
What does this skill help with?
It helps plan, run, monitor, and summarize Claude Flow multi-agent orchestration workflows.
Does it run commands automatically?
No. It provides command examples and process guidance that a user or agent may choose to run.
Which tools does it target?
It targets Claude Flow workflows and is listed for Claude, Codex, and Claude Code users.
What should I check before using it?
Confirm package trust, project permissions, agent limits, output paths, and any organization approval rules.
Can it recover blocked tasks?
It includes guidance for detecting blockers and reassigning or retrying stalled work.
Is final output guaranteed to be correct?
No. The skill recommends validation, but users must review synthesized results and project changes.
Developer Details
Author
DNYoussefLicense
MIT
Author version
v1.0.0
Skillstore revision
r1
Ref
c579efd02184f1128d6741d16e6c8d951d7d4208
Maintenance freshness
7/18/2026
Usage
4 downloads · 279 views
File structure